Risk Areas to Highlight
Are you preparing for an Integrated Baseline Review (IBR)? The IBR process is part of making sure your program is compliant with earned value management standards and that there is a robust baseline against which to track performance.
It’s also an exercise in risk identification. In fact, we’d go as far as to say that one of the major focus areas during the IBR prep work is to pull out as many risks as possible.
To do that, we like to categorize risks in the 5 areas noted by the Program Manager’s Guide to the Integrated Baseline Review Process: a DoD document that aims to help program manager’s standardize their interpretation of what the IBR process is all about. It calls out 5 risk areas:
- Technical risk
- Schedule risk
- Cost risk
- Resource risk
- Management process risk.
Let’s take a look at each of those and discuss how they might come out of the IBR process preparation.
1. Technical risk
Technical risk relates to the technical plan. The technical objectives will be considered as part of the performance management baseline review. It’s an opportunity to check understanding of requirements and to make sure that the deliverables are aligned to the client’s expectations.
Risks in this category refer to the deliverables themselves, which could be technical but might not be. For example:
- Solution design maturity
- Constraints around availability of software or technology
- Information security risk such as hacking, or non-malicious incidents such as service outages caused by energy blackouts.
2. Schedule risk
Unsurprisingly, schedule risk relates to potential problems to do with the timing and delivery against the schedule. The IBR should pull out a few risks relevant to scheduling because your team, or the IBR prep consultants, will be going through the schedule in detail. Make sure the team can identify tasks that are on the critical path, and focus on risks that would derail those activities.
Examples of risks that would fall into this category would include:
- The length of time it takes to get resources in post
- Delays in sourcing equipment due to global shortages
- The impact of dependencies on other projects or programs.
Review the schedule in light of potential risk and see if it remains reasonable. Make any changes required as part of risk management activities.
3. Cost risk
All programs carry an element of financial risk, and the program team can implement governance practices to phase the funding and manage the budget in accordance with the time-phased baseline to mitigate the impact of cost overruns. Getting those processes in place starts with having a good integrated baseline, but there are always other cost risks to consider as well.
Here are some examples of program financial risks that you might uncover during your IBR prep activities.
- Poor estimating practices resulting in increased costs
- Increases in the cost of raw materials
- Increases in the cost of securing trained and experienced resources.
4. Resource risk
Following on from the cost of resources, comes the risks related to resources themselves. Hopefully, by the time you come to prep for the IBR, you will have a team of experienced (or willing to learn) earned value management practitioners on site. You may also be supplementing your in-house team with relevant earned value management consultants to support through the IBR process. That might make the leadership team feel overly confident in their ability to manage resource risk throughout the project.
It’s worth taking the time to review the resource profile required today and through the life of the program to ensure risks are mitigated.
The kind of risks to consider for this category are:
- Strike action or unexpected downtime that prevents work from continuing to plan
- Inability to source the resources with the required expertise
- Key personnel leaving the program
- Other programs requiring the expertise of resources which dilutes their ability to focus on this work.
Remember that ‘resources’ are not limited to human resources. Look for risks related to facilities, equipment and raw materials as well, if these are required for delivery.
5. Management process risk
Finally, look for risks that fall into the category of management processes. That might seem vague, but it’s really around how the work is managed and controlled. Risks in this category can relate to technical aspects of process management, for example, making sure quality data is available, and also to cultural aspects of how the team is led.
Processes often add far more risk to a program than the team recognizes. After all, processes are supposed to be set up to support and underpin the program’s success, so to think that they actually introduce risk might seem strange. Spend some time considering how you and other organizations work together, as in our experience the risk is often in the handoffs and dependency management between organizations.
To give you some examples of management process risk, consider these:
- Reliability of systems that produce data including the level of training provided to new starters
- Data collection processes, especially data requirements from subcontractors
- Data review and quality management processes
- Level of leadership engagement and support for escalation processes.
The final point to make is that risk is not a bad thing. You might have read through that very high-level list and started to get concerned at the level of risk identification required and the management actions you’ll have to put in place to even begin to address them. Remember, knowing about risk is a good thing because you can make plans.
It is far better to do a deep dive into integrated program risk now, at this early point in the program while the IBR process is underway. That will give you information to share during the review process. In turn, that helps build a culture of transparency and openness, as well as creating confidence in the schedule and baseline.
Risk is not a bad thing, especially when you know about it and are actively managing it. We can’t avoid it, so help the team gain a full understanding of all the risk elements at play so they can move forward in confidence.